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American Bankers Association v. Lockyer. Whether 
California’s Financial Information Privacy Law Has 
Been Preempted by the Fair and Accurate Credit 
Transactions (FACT) Act 



Summary 

P.L. 108-159, the Fair and Accurate Credit Transaction (FACT) Act of 2003, 
extends a clause in the Fair Credit Reporting Act purporting to preempt state law and, 
thereby, establish a national standard for sharing of consumer financial information 
among affiliated companies. The legislative history of the FACT Act indicates 
awareness that California’s Financial Information Privacy Law, enacted in 2003, 
would be preempted. Nonetheless, on June 30, 2004, a federal court ruled, in 
American Bankers Association v. Lockyer , that the FACT Act preempted state law 
only with respect to credit report information and that an anti-preemption clause in 
the privacy title of P.L. 106-102, the Gramm-Leach-Bliley Act of 1999, permits 
states to enact more protective laws such as that of California. The federal banking 
regulators and the Federal Trade Commission joined the plaintiffs in urging the U.S. 
Court of Appeals for the Ninth Circuit to reverse the decision and to expedite the 
appeal. On June 20, 2005, the appellate court reversed the district court ruling and 
found that the FACT Act preempted the California law to the extent that it attempted 
to regulate communication among affiliated companies of information covered by the 
FCRA’s definition of “information.” On October 4, 2005, the district court issued 
an injunction against enforcement of the California statute’s affiliate information 
sharing provisions, having found that distinguishing information shared among 
affiliates that is covered by the FACT Act from that which could survive was not 
practicable. California has appealed this ruling. This report will be updated as 
events warrant. 
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American Bankers Association v. Lockyer. 
Whether California’s Financial Information 
Privacy Law Has Been Preempted by the 
Fair and Accurate Credit Transactions 

(FACT) Act 



Background 

The California Financial Information Privacy Act, 1 was enacted on August 28, 
2003, as Congress was considering the legislation that was to become the Fair and 
Accurate Credit Transactions (FACT) Act. 2 The California law became effective on 
July 1, 2004. It governs the rights of California residents with respect to the 
dissemination of nonpublic personal information by financial institutions. In some 
respects, it diverges from two federal laws that impose restrictions on the 
dissemination of customer information by financial institutions: (1) the privacy title 
of the Gramm- Leach Bliley Act of 1999 (GLBA) 3 and (2) 1996 amendments to the 
Fair Credit Reporting Act of 1970 (FCRA) 4 It includes a requirement that, before 
sharing nonpublic personal information with nonaffiliated third parties, financial 
institutions obtain an opt-in, i.e., affirmative consent, from their customers. 5 Before 
such information may be shared with affiliates not in the same line of business and 
regulated by the same functional regulator, an opt-out notice is required, i.e., a notice 
providing an opportunity to preclude disclosure of information. Wholly-owned 
subsidiaries and affiliates in the same line of business (securities, banking, or 
insurance) may share information, except medical information, without an opt-out 
or opt-in requirement. 

California’s law was enacted as a temporary federal statute purporting to 
preempt state regulation of information sharing among corporate affiliates was set to 
expire on December 31, 2003. The FACT Act, among other things, makes that 



1 Cal. Fin. Code §§ 4050 - 4060. 

2 P.L. 108-159, 117 Stat. 1952 (2004). 

3 P.L. 106-102, 11 Stat. 1338, 15 U.S.C. §§ 6801 et seq. 

4 P.L. 91-508, tit. VI; 84 Stat. 1 128; 15 U.S.C. §§ 601 et seq. 

5 For further information, see CRS Report RL31758, Financial Privacy: The Economics 
ofOpt-In vs Opt-Out , by Loretta Nott; and CRS Report RL31847, The Role of Information 
in Lending: The Cost of Privacy Restrictions , by Loretta Nott. 
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preemption permanent and limits the ability of affiliated companies to share 
consumer information for marketing solicitations. 6 

Federal Statutes on Affiliate Information Sharing: 

GLBA and FCRA 

Generally, both the Gramm-Leach-Bliley Act (GLBA) of 1999 7 and the Fair 
Credit Reporting Act (FCRA) of 1970, 8 as amended, address the issue of sharing of 
information about consumers among business entities. GLBA applies to “financial 
institutions.” It restricts entities, which are in the business of providing financial 
services, from sharing customer non-public personal information with non-affiliated 
third parties. FCRA regulates credit bureaus and the credit reporting business. It does 
not require such businesses to register or be chartered. Instead, it defines certain 
functions and regulates businesses performing those functions under the 
nomenclature of “credit reporting agencies.” It prescribes standards that address 
information used to determine eligibility of consumers for credit, insurance, or 
employment and covers “any person which, for monetary fees, dues, or on a 
cooperative nonprofit basis, regularly engages in whole or in part in the practice of 
assembling or evaluating consumer credit information or other information on 
consumers for the purpose of preparing or furnishing consumer reports.” 9 As 
originally enacted, FCRA did not include an express provision on the exchange of 
consumer credit information among affiliated companies. Subsequently, under the 
Fair Credit Act Amendments of 1996, 10 information sharing among affiliates was 
specifically excepted from the definition of “consumer report,” thereby permitting 
affiliated companies to share with one another customer information without 
implicating FCRA obligations and requirements. 11 

With respect to coverage of interaffiliate information sharing, FCRA preempts 
state law in broad language. GLBA takes an opposite approach; it contains an anti- 
preemption clause which preempts state laws only to the extent that state laws 
provide consumers less protection than does GLBA. Under GLBA, inconsistent state 
statutes, regulations, orders, or interpretations are preempted, to the extent of their 



6 For further information on the FACT Act, see CRS Report RL32535, Implementation of 
the Fair and Accurate Transactions (FACT) Act of 2003, by Angie A. Welborn and Grace 
Chu; CRS Report RS2 1449, Fair Credit Reporting Act: Preemption of State Law , by Angie 
A. Welborn; and, CRS Report RL32121, Fair Credit Reporting Act: A Side-by-Side 
Comparison of House, Senate and Conference Versions , by Angie A. Welborn and Loretta 
Nott. 

7 P. L. 106-102, 1 13 Stat. 1338, 15 U.S.C. §§ 6801 et seq. 

8 P.L. 91-508, tit. 6, § 601, 1 128; 15 U.S.C. §§ 1681 et seq. 

9 15 U.S.C. § 1681a(f). 

10 P.L. 104-208, Div. A, Tit., II, Subtitle d, Ch. 1, § 2419, 1 10 Stat. 3009-452, adding 15 
U.S.C. § 16811(b)(2). 

1 1 Exchange of experience and transaction information among affiliated companies is totally 
excluded from the definition of “consumer report”; exchange of other information among 
affiliates is excluded provided the consumer is given a notice and an opportunity to prevent 
the disclosure, an opt-out. 16 U.S.C. §§ 168 1 a(d)2)(A)(ii) and (iii). 
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inconsistency; and, a state law is not inconsistent “if the protection such statute, 
regulation, order, or interpretation affords any person is greater” than provided by 
GLBA. 12 The difficulty is that the FCRA provisions relating to affiliate information 
sharing and the GLBA privacy provisions do not clearly lay out their interaction with 
one another. GLBA requires an opt-out for financial institutions to share nonpublic 
personal information with non-affiliated third parties. It does not address any such 
requirement for interaffiliate sharing. GLBA does, however, require financial 
institutions to notify their customers of their privacy policy, including their policies 
with respect to information sharing among affiliates. GLBA also has a savings clause 
preserving the operation of FCRA. 13 

The FACT Act Provisions 

The FACT Act provision on information sharing among affiliated companies 
amends FCRA, 14 as amended in 1996. FCRA regulates the credit reporting business 
by prescribing standards for the credit reporting business and for users of consumer 
credit reports. It generally defines “consumer reports” and limits the purposes and 
conditions under which “consumer reports” maybe furnished by “consumer reporting 
agencies.” 15 Under the 1996 amendments, the definition of “consumer report” was 
amended to exclude communication of transaction and experience information 
among corporate affiliates. Also excluded, provided the consumer was afforded an 
opportunity to prevent it, i.e., opt out, was communication of other information 
concerning the consumer among affiliates. 16 Essentially, this permits companies to 
share with their affiliates certain information respecting their transactions and 
experience with a customer without any notification. Other customer information, 
such as credit reports and information supplied or gathered in connection with 
applying for loans or other services, may be shared with other companies in the 
corporate family if the customers are given “clear and conspicuous” notice about the 
sharing and an opportunity to direct that the information not be shared. 17 Under the 
1996 FCRA amendments, what had been the FCRA’ s general anti -preemption clause 
preserving more protective state law, was modified to specify federal preemption of 
state law until January 1, 2004, with respect to certain issues. Included among the 
issues temporarily preempted was the “exchange of information among persons 



12 15 U.S.C. § 6807. Under this provision, inconsistency is to be determined by the Federal 
Trade Commission (FTC). 15 U.S.C. § 6807(b). 

13 It reads: “[ejxcept for the amendments made by subsections (a) and (b)[relating to 
enforcement], nothing in this title shall be construed to modify, limit, or supersede the 
operation of the Fair Credit Reporting Act, and no inference shall be drawn on the basis of 
the provisions of this title regarding whether information is transaction or experience 
information under section 603 of such Act.” 15 U.S.C. § 6806(c). 

14 84 Stat. 1128, 15 U.S.C. §§ 1681 et seq. 

15 15 U.S.C. § 1681b. 

16 15 U.S.C. §§ 168 la(d)(2)(A)(ii) and (iii). 

17 15U..C. § 1 68 la(d)(2)(A)(iii). 
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affiliated by common ownership or common control.” 18 Under the FACT Act 
amendments, this preemption provision was made permanent and an additional 
limitation was placed on information sharing among affiliated companies. Subject 
to certain exceptions, affiliated companies may not share customer information for 
marketing solicitations unless the consumer is provided clear and conspicuous 
notification that the information may be exchanged and an opportunity and a simple 
method to opt-out. 19 

FACT Act Legislative History 

When the FACT Act was passed, there were indications of congressional 
awareness of the California Financial Information Privacy Act treatment of 
information sharing among affiliated companies. The California law was enacted as 
the FCRA temporary preemption of state law was about to expire, 
contemporaneously with congressional consideration of proposals to extend the 
FCRA preemption. The legislative history of the FACT Act includes references to 
the preemptive effect the FACT Act was anticipated to have on the California 
provisions respecting information sharing among corporate affiliates. The Conference 
Committee proclaimed that “the legislation will ... ensure the operational efficiency 
of our national credit system by creating a number of preemptive standards.” 20 Floor 
debate included statements that the bill would preempt the California law 
requirement with respect to sharing of information among affiliates 21 and rejection 



18 15 U.S.C. § 168 lt(b)(2). 

19 15U.S.C.§ 168 ls-3. The limitations with respect to using the information communicated 
among affiliates for marketing purposes is also covered by the preemption-of-state law 
provision. 15 U.S.C. § 168 ls-3(c). 

20 H.Rept. 108-396, 66 (2003) 

21 149 Cong. Rec. H 8120 (September 9, 2003, daily ed.) (Rep. Frank, a proponent of the 
measure, and ranking minority member of the committee reporting the bill, the House 
Financial Services Committee. In the Senate, the debate centered on S. 1753, which was 
passed by the Senate and its language, eventually, substituted for that of the House bill, H.R. 
2622, with reconciliation of the two versions occurring in the Conference Committee. In 
the Senate debate, Sen. Feinstein was clear in informing her colleagues that “this bill 
reduces the privacy rights of 36 million Californians.” 149 Cong. Rec. S 13980 (November 
5, 2003, daily ed.). Sen. Reed said that “[f]ailure to reauthorize national standards would 
balkanize our national credit system and potentially hurt every consumer in America,” and 
indicated that he was speaking inclusively of all affiliate information sharing. 149 Cong. 
Rec. S 13858 (November 5, 2003). According to Sen. Reed: 

When Congress passed the amendments to the Fair Credit Reporting Act in 1996, 
affiliate sharing had a very different meaning. The Gramm-Leach-Bliley Act had 
not yet been passed, and massive financial services holding companies had not 
emerged. Today, according to the Federal Reserve’s National Information 
Center, the largest bank holding company has at least 1639 affiliates as of June 
30, 2003. The meaning of affiliate sharing has changed, and will likely continue 
to change as the financial services industry adapts to changing times. Id., at S 
13859. 
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by the Senate of an amendment that would have made the California standard a 
national standard on affiliate information sharing. 22 

Preemption Analysis 

Preemption analysis begins with the Supremacy Clause of the U.S. 
Constitution. 23 Under it, Congress may override state laws in conflict with the 
exercise of powers delegated to it under Article I of the U.S. Constitution. When 
Congress has done so, preempted state laws are unenforceable. Determining whether 
a federal statute has a preemptive effect is a matter of statutory analysis. If Congress 
enacts legislation under one of its delegated powers that includes an explicit 
statement that state law is preempted, the Supreme Court generally will give effect 
to that legislative intent. 24 Where there is no language of preemption, the Court is 
likely to find preemption when it identifies a direct conflict between the federal law 
and the state law or when it concludes that the federal government has so occupied 
the field as to preclude enforcement of state law with respect to the subject at hand. 25 

Since the FCRA clause on affiliate information sharing contains explicit 
language of preemption, the issue is one of statutory construction, i.e., discerning and 
giving effect to congressional intent. 26 Generally, that intent is determined by 
examining the statutory language, giving effect to its plain meaning in relation to its 
context in the statute, and, if further elaboration is necessary, its legislative history. 27 
In dealing with matters traditionally within the power of states to protect public 
health and safety, i.e., the police power, the Supreme Court often applies a 
presumption against preemption. 28 In some recent decisions upholding an express 
federal preemption, however, the presumption against preempting state police power 
laws or regulations did not figure in the Court’s analysis. These cases seem to have 



22 S. Amend. 2054, offered by Sen. Feinstein, 149 Con. Rec. 13860 (November 5, 2003). 

23 U.S. Const., Art. VI, cl. 2. It declares that the Constitution and “the Laws of the United 
States which shall be made in Pursuance thereof ... shall be the supreme Law of the Land 
... any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.” 

24 Rice v. Santa Fe Elevator Corp. , 33 1 U.S. 2 1 8, 230 (1947); Wisconsin Public Intervenor 
v. Mortier , 501 U.S. 597, 605 (1991). 

25 CRS Report 97-589, Statutory Interpretation: General Principles and Recent Trends, by 
George Costello. 

26 “The purpose of Congress is the ultimate touchstone” in every preemption case. Retail 
Clerks v. Schermerhorn, 375 U.S. 96, 103 (1963). 

27 See Cipollone v. Liggett Group, Inc., 505 U.S. 504, 532 (Blackmun, J. concurring in part 
and dissenting in part). 

28 See, e.g., Medtronic, Inc. v. Lohr, 518 U.S. 485 (1996) (express preemption provision in 
the 1976 Medical Device Amendments to the Federal Food, Drug, and Cosmetic Act did not 
preempt state tort action for a defective pacemaker); Cipollone v. Liggett Group, Inc., 505 
U.S. 504 (1992) (express preemption clause in federal cigarette labeling legislation read 
narrowly in light of presumption against preemption of state police power and state tort 
action found not preempted). 
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been confined to examining the language and legislative history of the provision in 
question. 29 

District Court Ruling: American Bankers Association v. 
Lockyer 

In American Bankers Association v. Lockyer, 30 the American Bankers 
Association, the Consumers Bankers Association, and the Financial Services 
Roundtable challenged the validity of California’s Financial Information Privacy 
Act 31 treatment of information sharing among affiliated companies. Specifically, at 
issue is the California prohibition on disclosure of a consumer’s nonpublic personal 
information to the financial institution’s affiliates without providing the consumer 
with written notice and a reasonable opportunity to prevent the disclosure, i.e., an opt 
out. Plaintiffs maintained that the provision is preempted by the FCRA, as amended 
in 1996 and by section 214 of the FACT Act 32 in 2003. The California Attorney 
General, defended the California statute as permissible under the GLBA anti- 
preemption clause, which preserves any state law that is more protective. 33 

At the district court level, the court identified its task as that of determining 
Congressional intent. To do so, it assumed that a narrow reading must be given to 
the FCRA/FACT Act preemption provision and a presumption against preemption 
invoked because the California law represented the exercise of the state’s police 
power. 34 The court relied on the purposes enunciated in FCRA 35 and various judicial 



29 In Lorillard Tobacco Co. v. Reilly, 533 U.S. 525 (2001), the Court found Massachusetts 
regulations on sale of tobacco products to minors to be preempted by federal cigarette 
labeling laws as requirements on smoking and health. The court examined the legislative 
history of the cigarette labeling laws, including the language in a previous version of the 
federal law. In Geier v. American Honda Motor Co, Inc., 529 U.S. 861 (2000), a state tort 
action for failure to equip a certain vehicle with an airbag was held to have been preempted 
by a federal motor vehicle safety standard promulgated under the National Traffic and 
Motor Vehicle Safety Act of 1966, 80 Stat. 718, under which an airbag was not required on 
the particular vehicle. See, Susan Raeker- Jordan, “A Study in Judicial Sleight of Hand: Did 
Geier v. American Honda Motor Co Eradicate the Presumption Against Preemption,” 17 
Brigham Young University Journal of Public Law 1 (2002); Mary J. Davis, “ Unmasking the 
Presumption in Favor of Preemption,” 53 South Carolina Law Review 967 (2002). 

30 F.Supp. 2d (E.D.Cal. 2004), 2004 WL 1490432. 

31 Cal. Fin. Code §§ 4050 - 4060. 

32 P.L. 108-159, 117 Stat. 1952, 1980(2004). 

33 15 U.S.C. § 6807. 

34 It drew this presumption from three cases, one of which involved express language of 
preemption. That was Cipollone v. Liggett Group, Inc., 505 U.S. 504 (1992) (cigarette 
labeling statute’s express preemption provision held by a plurality of the Court to preempt 
a state common law negligence action by taking a narrow view of the scope of the express 
preemption provision and invocation of presumption against preemption when dealing with 
a state’s police power). In California v. ARC Am. Corp., 490 U.S. 93 (1989), a state 
antitrust law allowing indirect purchasers to recover damages in price fixing cases was held 

(continued...) 
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interpretations of the scope of the FCRA in construing it, not as a system for 
regulating commercial dissemination of consumer information but as regulation of 
consumer reporting agencies and the contents of consumer reports. It invoked an 
appellate court FCRA decision 36 to draw a distinction between consumer reports and 
the information they contain when that information is not used, expected to be used, 
or collected for one of the permissible purposes of “consumer reports” under the 
FCRA. 37 It then examined the FCRA provisions excluding information exchanged 
among affiliates from the definition of “consumer report” and preempting state laws 
on affiliate information sharing. 38 The latter reads: 

[n]o requirement or prohibition may be imposed under the laws of any State ... 
with respect to the exchange of information among persons affiliated by common 
ownership or common corporate control, except that this paragraph shall not 



34 (...continued) 

not to be preempted as an obstacle to the accomplishment of a federal antitrust statute in 
view of the long exercise of state police power in the antitrust area. In General Motors v. 
Abrams, 897 F. 2d 34 (2d Cir. 1990), an FTC consent order was held not to preempt New 
York State’s lemon law by occupying the field in consideration of the tradition of state 
regulation of trade practices. 

35 The court relied on 15 U.S.C. § 1681. It includes Congressional findings and a statement 
of purpose. The latter states that the purpose of the legislation is “to require that consumer 
reporting agencies adopt reasonable procedures for meeting the needs of commerce for 
consumer credit, personnel, insurance, and other information in a manner which is fair and 
equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and 
proper utilization of such information in accordance with the requirements of this chapter.” 

36 Ippolito v. WNS, Inc., 864 F. 2d 440 (7 th Cir. 1988). The portion of the opinion that 
Lockyer relied on stated: 

as defined in §§ 168 la(d) and 1681b, not all reports containing information on 
a consumer are ‘consumer reports.’ To constitute a ‘consumer report,’ the 
information contained in the report must have been ‘used or expected to be used 
or collected in whole or in part’ for one of the purposes set out in the FCRA if: 

(1) the person who requests the report actually uses the report for one of the 
‘consumer purposes’ set forth in the FCRA; (2) the consumer reporting agency 
which prepares the report ‘expects’ the report to be used for one of the 
‘consumer purposes’ set forth in the FCRA; or (3) the consumer reporting agency 
which prepared the report originally collected the information contained in the 
report expecting it to be used for one of the ‘consumer purposes’ set forth in the 
FCRA. Ippolito v. WNS. Inc., 864 F. 2d 440 , 449 (7 lh Cir. 1988), cert, denied. 

The decision involved a claim that a consumer report was illegally obtained. The court 
ruled that because the purpose for which the report was intended did not involve consumer 
credit, insurance, etc., but investigation of the owners of a business by another business in 
connection with litigation, the information supplied by the consumer reporting agency was 
not a “consumer report.” 

’ 15 U.S.C. § 1681b (consumer’s request, court order, consumer credit transaction, 

insurance, government benefit eligibility, child support agency, and employment). For 
further information, see, CRS Report RL31666, Fair Credit Reporting Act: Rights and 
Responsibilities, by Angie A. Welborn. 

15 U.S.C. § 16811(b)(2). 



38 
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apply with respect to subsection (a) or (c)(1) of section 2480e of title 9, Vermont 

Statutes Annotated (as in effect on September 30, 1996). 39 

It noted that the FCRA language, on its face, seems to preempt all state laws on 
affiliate sharing of consumer information. It then reasoned that interpreting the 
language of preemption that way would encompass broader coverage than the 
underlying legislation and, thereby, cover all information rather than just consumer 
credit information or credit report information. 

The court reasoned that since information sharing among affiliates is exempted 
from the FCRA’s definition of “consumer report,” it would make no sense for the 
FCRA to exclude affiliate information sharing from FCRA coverage in that manner 
in one clause and in another bring it within the ambit of the statute by precluding 
states from regulating it. The court saw this reasoning reinforced by the fact that the 
same clause that preempted state law with respect to affiliate sharing of information 
specifically preserved a Vermont law from preemption, which applied state credit 
reporting law to affiliate sharing of information. 40 

GLBA was also a factor in the court’s decision. That its notice requirement 
applies to affiliate information sharing led the court to read the GLBA anti- 
preemption clause to cover California’s right to enact its opt-out requirement for 
affiliate information sharing. To support this conclusion, it quoted from the 
legislative history, including the following remark by Senator Sarbanes, the sponsor 
of the anti-preemption clause: “We were able to include in the conference report an 
amendment that I proposed which ensures that the Federal Government will not 
preempt stronger State financial privacy laws that exist now or may be enacted in the 
future. As a result, States will be free to enact stronger financial privacy safeguards 
if they deem it appropriate.” 41 



39 The Vermont law places strictures on the release of credit reports. The FCRA preemption 
provision is stated as a general exception to FCRA’s general anti -preemption clause , 15 
U.S.C. § 168 lt(a), preserving state laws. 

40 The court appears to have overlooked the fact that the Vermont statute’s coverage of 
credit reports was broader than FCRA’s coverage of “consumer reports,” and, therefore, 
would have covered affiliate information sharing but for the exclusion. 

145 Cong. Rec. S 13789 (November 3, 1999, daily ed.). 



41 
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Issues on Appeal 

In the appeal of Lockyer, to the U.S. Court of Appeals for the Ninth Circuit, 42 
the appellant was supported by financial services trade associations 43 and federal 
bank, thrift, and credit union regulators, and the Federal Trade Commission (FTC). 44 
The American Bankers Association, the Financial Services Roundtable, and the 
Consumer Bankers Association, who are the appellants in the case, argue for a plain 
meaning interpretation of the FCRA language. In their view, the sharing of customer 
information among affiliated companies is “the essential predicate to offering 
comprehensive banking, insurance, and securities products” to customers of financial 
services companies. 45 Their premise is that the nation-wide integrated financial 
services companies authorized by financial modernization legislation 46 relies on the 
three laws at issue and that, contrary to the district court’s interpretation, the FCRA’s 
1996 amendments and the FACT Act provide comprehensive regulation of customer 
information sharing among affiliated financial companies. They appear to fault the 
district court for considering “consumer reports” only in the narrow or technical 
sense of information covered by the FCRA that is subject to the most stringent 
limitations on providers, users, or collectors and is generally obtained through 
consumer reporting agencies. They see the three laws on a continuum and the district 
court as ignoring the plain language of the FCRA preemption, the clause in GLBA 
that preserves the operation of the FACT Act, and the legislative history of the FACT 
Act. They argue that the district court should not have engaged in contextual 
exegesis of unambiguous language and that, in doing so, the court limited the scope 
of the statutory language. They further argue that the contextual analysis was 
incomplete since it failed to note the contrast the subject provision has with other 
preemption provisions in FCRA that do include limiting language. 47 They take issue 



42 American Bankers Association v. Lockyer, appeal docketed, No. 04-16334 (9 th Cir. July 
28, 2004). 

43 There are amicus briefs representing: (1) the Investment Company Institute, Securities 
Industry Association, Investment Counsel Association of America, American Insurance 
Association, American Council of Life Insurers, and the National Business Coalition of E- 
Commerce and Privacy; (2) the Clearing House Association; (3) E-Loan, Inc.; and, (4) 
Citizens for a Sound Economy. 

44 Amicus Curiae Brief of the Office of Thrift Supervision, the Office of the Comptroller 
of the Currency, the Federal Deposit Insurance Corporation, the Board of Governors of the 
Federal Reserve System, the National Credit Union Administration, and the Federal Trade 
Commission in Support of Appellants, American Bankers Association v. Lockyer, (9 th Cir. 
No. 04-16334) (hereinafter, Regulators’ Brief). 

45 Brief of Plaintiffs- Appellants at 2, American Bankers Association v. Lockyer, (9 lh Cir. No. 
04-16334). 

46 “[TJhey operate as integrated financial services businesses, often under a common brand,” 
sharing “customer information among their affiliates to provide comprehensive, seamless 
services and products that customers expect, especially from commonly branded entities — 
e.g., immediate transfer of funds and balance information between a bank and its securities 
affiliate.” Id., at 16. 

47 For example, 15U.S.C. § 1618t(b)(l)(A). FCRA has a general savings clause, 15U.S.C. 

(continued...) 
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with the district court’s conclusion that the FCRA is concerned only with “consumer 
reports,” citing legislative history of the 1996 amendments 48 and of the FACT Act 49 
to this end. With respect to the presumption against preemption, the appellants 
argue that it cannot overcome explicit, clear language of preemption. The appellants 
also argue that the GLBA anti-preemption clause does not apply to state laws 
preempted under FCRA and cites legislative history to this effect. 50 

The amicus brief of the federal banking regulators in support of the appellants 
also argues for a plain meaning construction of the FCRA/FACT Act language. It 
views the district court decision as predicated “on a fundamental misperception of 
the framework and scope of FCRA” 51 and as one that is “frustrating Congress’ 
objective.” 52 It portrays FCRA, FACT Act, and GLBA, as a “carefully crafted 
national system to govern the accumulation, dissemination and use of a consumer’s 
personal financial information.” 53 It contains considerable treatment of the legislative 
history and the rationale behind the inclusion in the 1996 FCRA amendments of the 
preemption of state law with respect to information sharing among affiliates. This 
is used to discredit the court’s interpretation of the FCRA as too narrow. According 
to the federal regulators, FCRA, as originally enacted, contained an exemption 
permitting all businesses to share with other entities information about their own 
dealings — i.e., “experience and transaction” information — without being subject 



47 (...continued) 

§ 168 lt(a), preserving state laws that do “not annul, alter, affect, or exempt any person 
subject to [its] ... provisions ... from complying with the laws of any State with respect to 
the collection, distribution, or use of any information on consumers, except to the extent that 
those laws are inconsistent with any provision of [FCRA] ... , and then only to the extent of 
the inconsistency.” One of the exceptions to this clause is 15 U.S.C. § 1618(b)(1)(A) which 
states that “No requirement or prohibition may be imposed under the laws of any State ... 
with respect to any subject matter regulated under ... subsection (c)or(e) of section 1681b 
of this title, relating to the prescreening of consumer reports.” [Emphasis added to indicate 
the limiting language referred to in the American Bankers’ Association brief.] 

48 Authorities cited for this include the detailed legislative history analysis written by the 
General Counsel of the House Banking Committee during the time of Congressional 
consideration of the 1996 FCRA amendments, i.e., Joseph L. Seidel, The Consumer Credit 
Reporting Reform Act: Information Sharing and Preemption, 2 N.C. Banking Institute 79 
(1998). 

49 Floor statements include those of Sen. Feinstein, 149 Cong. Rec. S 13848, 13860 
(November 4, 2003, daily ed.); Sen. Boxer, id., at S13874; Sen. Shelby, floor manager of 
the bill, 149 Cong. Rec. S13863, 13873 (November 4, 2003 daily ed.); and Sen Durbin, 149 
Cong. Rec. at S 13875 (November 4, 2003, daily ed.). 

50 145 Cong. Rec. S 13883, 13901 (daily ed. Nov. 4, 1999), in which Sen. Gramm assured 
Sen. Mack that “Section 507 is intended to apply only to subtitle A of title V of the bill, and 
is not to be construed to apply to any provision of law other than the provisions of this 
subtitle. Thus, section 507 does not affect the existing FCRA provisions on that statute’s 
relationship to state laws.” 

51 Regulators' Brief, at 16. 

52 Id., at 14. 

53 Regulators' Brief, at 1-2. 
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to regulation as credit reporting agencies. In the 1990’s, this became a problem for 
holding companies: transaction and experience information could be shared with an 
affiliate without triggering the added regulatory requirements, but information 
derived from one affiliate could not be shared by another affiliate with a third 
affiliate. Anything else could not be shared among affiliates without compliance 
with the obligations imposed on credit reporting agencies. In that situation, 
according to the regulators, affiliated companies were inhibited from sharing any 
information among themselves. The 1996 amendments remedied this by treating 
affiliated companies as if they were one company for the purposes of sharing 
experience and transaction information and by permitting affiliated companies to 
share other information among affiliates subject to an opt-out. According to the 
regulators: 

At the same time that it established the federal criteria that enabled affiliates to 
share a broad range of consumer information without becoming consumer 
reporting agencies, the 1996 legislation also expressly preempted state laws that 
impose requirements or prohibitions ‘with respect to the exchange of information 
among persons affiliated by common ownership or common corporate control.’ 

15 U.S.C. § 168 lt(b)92). The type of information covered by this preemption 
was not limited to ‘consumer report’ information. The combined effect of these 
provisions was to set national, uniform requirements for the sharing of consumer 
information among affiliates. 54 

They argue that GLBA’s anti-preemption clause does not permit the states to enact 
restrictions on affiliate information sharing; rather, it is limited to the provisions of 
GLBA and does not affect the preemptive force of FCRA. 

California, supported by 27 states 55 and the District of Columbia, argues for 
upholding the district court’s ruling. California has four major arguments. The first 
is that the presumption against preemption in state police power cases requires 
unambiguous statutory language. California maintains that the right of the states “to 
legislate within their historic police power to protect consumers” requires that the 
preemptive language be given a narrow reading to preempt only state consumer 
reporting laws, rather than all state laws. 56 It sees the language at issue as ambiguous. 
It contend that even the American Bankers’ Association is not advocating a literal 
reading of the plain language of the preemptive clause of the FCRA and that such a 
reading would invalidate all state laws respecting information sharing, “financial or 
consumer or otherwise,” among affiliated corporations. 57 



54 Regulators’ Brief, at 6. 

55 Vermont, Arkansas, Colorado, Connecticut, Delaware, Hawaii, Illinois, Iowa, Louisiana, 
Maine, Maryland, Massachusetts, Minnesota, Mississippi, Montana, Nevada, New 
Hampshire, New Mexico, New York, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island 
Tennessee, Washington, and Wisconsin. 

56 Brief of Appellees California Attorney General Bill Lockyer and California Insurance 
Commissioner John Garamendi, American Bankers Association v. Lockyer 2 (9 th Cir. No. 
04-16334) (hereinafter. Brief of Appellees). 



57 



Id., at 11. 
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The state offers a second argument, that the FCRA preemption provision 
preempts only state laws regulating consumer reporting. This draws on 1996 
legislative history for support. According to California, the motivating factor and 
main purpose of preempting state laws with respect to information sharing among 
affiliates was to eliminate the possibility that affiliated companies would be treated 
as credit reporting agencies under the FCRA and under state credit reporting laws. 
The state argues that the banking associations “have not cited anything in the 
legislative history of the 1996 amendments supporting their interpretation that 
Congress intended the FCRA to reach beyond the scope of consumer reporting to 
void state financial privacy laws like [the California law].” 58 

A third argument characterizes the American Bankers’ Association’s resort to 
FACT Act legislative history as “muddying the waters” and “legally and logically 
irrelevant in discerning the intent of Congress when it added the affiliate-sharing 
preemption provision to the FCRA in 1996.” 59 According to California, the FACT 
Act did not alter the meaning of the preemption clause; it merely eliminated a 
provision by which it was scheduled to sunset. It asks the court to refrain from 
drawing any inference that California’ s law was considered preempted by any failure 
by Congress to enact any proposed amendments 60 

A final argument relies on the savings clause in GLBA’s privacy title. 
According to the state, GLBA “expressly preserved the ability of the states to enact 
consumer protection statutes providing greater privacy protection,” and that “[t]his 
is precisely what California did.” 61 The brief relies on legislative history, particularly 
the statement by Senator Sarbanes , supra at 8, that was quoted in the district court’s 
decision. 62 

Analysis of the District Court’s Decision 

The district court’s ruling, with its refusal to limit itself to the strict language of 
the FCRA preemption clause and its narrow reading of FCRA’ s potential reach and 
of the legislative history of the 1996 and 2003 amendments, may have surprised 
legislators, regulators, and financial services trade groups. It may have been 
welcomed by consumer groups, privacy advocates, and opponents of increasing 
federal power. Whether the decision is ultimately reversed or not, the ruling is 
interesting because it appears to embrace a view of a provision, the temporary 
enactment and permanent extension of which was hotly debated, widely discussed, 
and almost universally acknowledged to be precisely what the court ruled it was not. 
The reason for the disparity between the perception during the debate and the 
interpretation of the court, six months later, may, therefore, provide some 



58 Id., at 23. 

59 Id., at 2. 

60 Authorities cited included Solid Waste Agency v. United States Army Corp of Engineers, 
531 U.S. 159 (2001) and Pension Benefit Guar. Corp. v. LTV Corp., 496 U.S. 633 (1990). 

61 Id., at 10. 

62 Id., at 64. 
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illumination to followers of the legislative process. The straight language of the 
affiliate information sharing preemption was not free-standing legislation but was 
surrounded by the language, structure, and purposes of the Fair Credit Reporting Act. 
It was the placing of this language within the confines and constrictions of a law that 
had limited purposes that was viewed by the district court as requiring a contextual 
analysis rather than a limited parsing of the verbiage of the simple language of the 
affiliate information sharing preemption. 

Despite this fact, however, there are various issues that the district court’s 
opinion raises that might lead an appellate court to reach a different conclusion. 
Among them are the following: 

1. Did the court do a sufficient job of analyzing what the FCRA regulates? 
FCRA regulates “consumer reporting agencies,” which, by definition would likely 
include financial services companies that share with their affiliates the kind of 
information that is covered by the FCRA definition of “consumer report.” 
Specifically, financial services companies share non-transaction and non-experience 
information bearing on a consumer’s credit worthiness, which is used or expected 
to be used to serve in determining eligibility for credit, insurance, employment or 
other purposes covered by the FCRA. 63 Such information is regulated by the FCRA 
when it is disseminated among affiliated companies unless the company disclosing 
such information to its affiliates provides consumers with a notice and an opt-out. 
Without the notice and opt-out, the disclosure would constitute a consumer credit 
report under FCRA and, thus, by inference, the disclosing company would be subject 
to regulation as a credit reporting agency. 

2. The court, in construing the statute, overlooked the statutory history of the 
1996 amendments. While there is considerable ambiguity in this legislative history, 
it may provide support for the view that Congress intended to preclude any state law 
placing further limits on interaffiliate sharing of information on consumers. 64 

3. The court’s analysis of GLBA may be open to question. As the court, in 
Bank of America, N.A. v. City of Daly City, 65 recognized, most commentators have 
read GLBA to be a law regulating the sharing of nonpublic personal information 
about consumers by companies with non- affiliated third parties, not a general law 
regulating the sharing of such information among affiliates and non- affiliated third 
parties. Its only provision respecting sharing of information among affiliates is the 
requirement that the institution’s policy with respect to sharing information among 
affiliates be disclosed in its privacy notice. Its only specification with respect to this 
notice is that the notice under the FCRA opt-out requirement be included in the 
GLBA privacy notice. 



63 15 U.S.C. § 168 la(d). 

64 See, Seidel, supra , n.48. 

65 Bank of America, NA. v. City of Daly City, 279 F. Supp. 2d 1118 (N.D. Cal. 2003), 
vacated as moot, 9 lh Cir. May 14, 2004. The district court held local ordinances invalid as 
having been preempted by the FCRA language. On appeal of another issue, the decision 
was vacated as moot. 
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4. OCC, one of the regulators charged with writing the GLBA rules, has taken 
the position that “[t]he FCRA preemption provision ensures that affiliated entities 
may share customer information without interference from State law and subject only 
to the FCRA notice and opt-out requirements if applicable. The preemption is broad 
and extends beyond state information sharing statutes to preempt any State statute 
that affects the ability of an entity to share any information with its affiliates. 
Congress intended the preemption provision to establish a national uniform standard 
in this area ....” 66 

The Ninth Circuit Ruling: American Bankers Association v. 
Gouicf 7 

On appeal, the U.S. Court of Appeals for the Ninth Circuit reversed the district 
court and held that the California law was preempted by the FCRA’s affiliate- 
information-sharing provisions. The court was careful to limit its holding by 
emphasizing that the preemption extended only to “information” covered by the 
FCRA definition of “consumer report.” 68 The court outlined FCRA as a regime 
governing “consumer reporting agencies” and “consumer reports,” which exempts 
from its coverage the sharing of consumer-report information among affiliated 
companies under certain conditions. To reach these conclusions it set forth premises 
on which its analysis of the preemptive scope of federal legislation was based: (1) 
preemption depends on congressional intent; (2) in an area of traditional state 
authority, such as consumer protection, congressional intent must be clear; (3) 
analysis must begin with the plain statutory language, which is to be viewed within 
the overall context of the regulatory scheme, interpreted as a coordinated whole. 69 

The court found FCRA’s preemption to cover only information within the 
FCRA definition of “consumer report.” That definition extends to “information ... 
bearing on a consumer’ s credit worthiness, credit standing, credit capacity, character, 
general reputation, personal characteristics, or mode of living which is used or 
expected to be used or collected in whole or in part for the purpose of serving as a 
factor in establishing the consumer’s eligibility for” certain purposes. 70 It remanded 



66 Letter from Julie L. Williams, First Senior Deputy Comptroller and Chief Counsel, 

Office of the Comptroller of the Currency, to Sandra Murphy, Bowles Brice McDavid Graff 
& Love (September 24, 2001), quoted in Bank of America v. City of Daly City, 279 F. Supp. 
2d 1 1 18, 1 122 (N.D. Cal. 2003), vacated as moot F.3d _ (9 lh Cir. 2004). 

67 412 F. 3d 1081 (9 lh Cir. 2005). 

68 15 U.S.C. § 1681a(d)(l). 

69 For this, the court relied on Food & Drug Admin, v. Brown & WilliamsonTobacco Corp . , 
529 U.S. 120, 133 (2000). 

70 15 U.S.C. § 1681a(d)(l). This specifies the following authorized purposes: “(A) credit 
or insurance to be used primarily for personal, family, or household purposes; (b) 
employment; or (C) any other purpose authorized under 1681b of this title.” Id. Section 
1681(b) adds, among others, the following purposes, subject to certain conditions: 
“determination of the consumer’s eligibility for a license or other benefit granted by a 
governmental instrumentality ...”; for insurance underwriting determinations involving the 

(continued...) 
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the case to the district court for a determination of whether, in light of the restricted 
meaning of “information” under FCRA, any of the affiliate-information- sharing 
provisions of the California law survive preemption under FCRA, and, if so, whether 
such provisions could be severed so as to be enforceable. 

It also ruled that the provision of GLBA purporting to preserve FCRA’s 
operation, 71 acted to preserve FCRA’ s preemptive scope, thus, making GLBA’ s anti- 
preemption clause 72 irrelevant. 

District Court Ruling on Remand: American Bankers 
Association v. Lockyei 73 

On October 4, 2005, in American Bankers Association v. Lockyer, the district 
court issued an injunction against the enforcement of the affiliate information- sharing 
provisions of the California legislation. It found no practicable way of distinguishing 
FCRA affiliate information- sharing protected by the FACT Act preemption clause 
from affiliate information- sharing which could be subjected to state law. The court 
began with the premise, derived from the FCRA definition of “consumer report,” 74 
that FCRA covered “information” that met two standards: scope and use. For 
information to be considered a “consumer report,” it must be the type of information 
falling within the scope set forth in the definition of “consumer report.” It must also 
meet the definition’s condition that the information be used for one of the purposes 
set forth in the definition. The court found that virtually all information collected on 
consumers would fall within the identified scope since it was likely to concern “credit 
worthiness, credit standing, credit capacity, character, general reputation, personal 
characteristics, or mode of,” 75 but that only a portion of the information collected by 



70 (...continued) 

consumer; child support enforcement; and response to a court order or a federal grand jury 
subpoena. 

71 15 U.S.C. § 6806. 

72 15 U.S.C. § 6807. 

73 _ F.Supp. 2d , 2005 WL2452798 (E.D.Cal. 2005). 

74 15 U.S.C. § 1681a(d)(l). Under this definition: 

The term "consumer report" means any written, oral, or other 
communication of any information by a consumer reporting agency bearing on 
a consumer's credit worthiness, credit standing, credit capacity, character, general 
reputation, personal characteristics, or mode of living which is used or expected 
to be used or collected in whole or in part for the purpose of serving as a factor 
in establishing the consumer's eligibility for— 

(A) credit or insurance to be used primarily for personal, family, or household 
purposes; 

(B ) employment purposes; or 

(C) any other puipose authorized under section 604 

75 “Scope” covers information that concerns a consumer’s “credit worthiness, credit 
standing, credit capacity, character, general reputation, personal characteristics, or mode of 
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the plaintiff financial institutions fit within FCRA authorized purposes. 76 The 
problem, however, was that there was no way of determining in advance which 
pieces of information would never be put to one of the uses or purposes covered by 
the FCRA. 77 The court also decided that it had no power to sever those portions of 
the California statute’s affiliate information-sharing provisions that were 
unconstitutional as being federally preempted from any that could survive. 

California’s Attorney General, Bill Lockyer, has appealed the district court 
ruling. 78 

Legislation 

Although no specific legislation has been introduced to address the California 
situation, there have been measures to address the question of financial privacy 
generally. 79 There is a possibility that, since the appeals court has upheld the position 
of federal regulators and financial services industry trade associations, consumer 
advocates might seek legislation to overturn the decision. This could mean a replay 
of the policy debates occurring prior to passage of the FACT Act. Consumer 
advocates 80 and state attorneys generals 81 would again speak in favor of preempting 
only state law that does not provide consumers the same level of protection; and 
federal regulators and financial services companies would argue for the national 
uniformity that federal preemptions brings. 



75 (...continued) 

living.” 15U.S.C. § 168 la(d)( 1). 

76 FCRA covers “information” that is “used, expected to be used, or collected for the 
purpose of establishing eligibility for credit or insurance, employment, or [other authorized 
purposes]. 15 U.S.C. § 168 la(d)( 1). 

77 The court stated that, “[wjhile in theory it seems financial institutions could delineate in 
advance what information enjoys federal protection and which does not, in practice any such 
delineation would simply be conjecture.” 2005 WL 2452798, at 3. 

78 American Bankers Assoc, v. Lockyer, 9th Cir. No. 05-17163, appeal docketed 1 1/9/05). 

79 See CRS Report RS20185, Privacy Protection for Customer Financial Information, by 
M. Maureen Murphy. 

80 See Hearings on H.R. 1622, the Fair and Accurate Credit Transactions Act before the , 
House Committee on Financial Services (July 9,2003), Testimony of Chris Hofnagle, 
Deputy Counsel, Electronic Privacy Information Center and Testimony of Stephen Broback, 
Education Director, Consumer Federation of America, at 4, ff. Available September 30, 
2004 at [http://financialservices.house.gov/hearings.asp?formmode=detail&hearing=244]. 

81 See Hearings on Fair Credit Reporting Act: How it Functions for Consumers and the 
Economy before the Subcommittee on Financial Institutions and Consumer Affairs of the 
House Financial Services Committee (June 4, 2003), Testimony of Julie Brill, Assistant 
Attorney General of the State of Vermont, at 16. Available September 30, 2004 at 
[http://financialservices. house.gov/hearings. asp?formmode=detail&hearing=225]. 




